Current Antivirus logs continuous intrusion attacks from same IP

[jmwang037]

Hi, would appreciate some urgent assistance as I believe that all my browsers/laptop have somehow been hijacked/possible keylogger. I have Norton 360, and also run Malwarebytes (free version) scans on an on-demand basis.

Would need some advice urgently here. I was browsing the net searching for some music download links and Norton blocked some of the sketchy sites' intrusion attempts when I tried to download an mp3 file. As per normal, I left the site - however, this time, somehow Norton keeps logging the same attacks by the same IP even when I am not on the site anymore - it also definitely happens when I use google to search the keywords I used the first time "download kpop music" – an attack is logged even up to two days later when I do the same search, and happens whether I use Chrome or Edge (but both when I use google search to search the keywords), so this issue is not localised to Chrome. The weird thing is only this specific search triggers the web attack.

Steps I have done include:
1. Clearing all browser history from 24h ago (all items checked)
2. Using the Google Clean Up computer function - no harmful software found
3. Resetted Chrome using the Restore settings to their original defaults function a few times
4. Uninstalled and re-installed Chrome
5. Ran Malwarebytes Premium scan and Norton full scan - nothing found as well

The attacks continued to happen after I did the above.

I am pretty much at my wits end now and would seriously appreciate any advice on how I can prevent more of these attempts from the same IP, the continuous attacking is making me very troubled because I am taking my e-exams in a few days and would rather not have such attacks popping up every now and then during the proctored exam.

Have attached all the required logs.

Thank you very much in advance!
 

 

Addition.txt FRST.txt Malwarebytes log.txt

[jmwang037]

Ah, forgot to add but I have also run Malwarebytes AdwCleaner, nothing found as well.

[AdvancedSetup]

Hello @jmwang037

Please go to Control Panel, Programs, Programs and Features and uninstall the following old and compromised software.

Java 8 Update 51

 

It looks like Norton itself faulted the other day

Error: (05/20/2021 10:43:48 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: NortonSecurity.exe, version: 17.2.3.57, time stamp: 0x6066105d
Faulting module name: ntdll.dll, version: 10.0.19041.964, time stamp: 0xbd2c3c23
Exception code: 0xc0000374
Fault offset: 0x00000000000ff199
Faulting process id: 0x24cc
Faulting application start time: 0x01d74d85b856d97d
Faulting application path: C:\Program Files\Norton Security\Engine\22.21.3.48\NortonSecurity.exe
Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll
Report Id: a46126de-6bc2-48aa-9827-af432fc2efb3
Faulting package full name:
Faulting package-relative application ID:

 

 

Please temporarily disable Norton Antivirus and then run the following fix.

 

Please download the attached fixlist.txt file and save it to the Desktop or location where you ran FRST from.
NOTE. It's important that both files, FRST or FRST64, and fixlist.txt are in the same location or the fix will not work.

Please make sure you disable any real time antivirus or security software before running this script. Once completed make sure you re-enable it.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt) or wherever you ran FRST from. Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

NOTE-1:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity. Depending on the speed of your computer this fix may take 30 minutes or more.

NOTE-2: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. Also, make sure you know the passwords for all websites as cookies will also be removed. The use of an external password manager is highly recommended instead of using your browser to store passwords.

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Flash Player cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• BITS transfer queue (qmgr*.dat files)
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run.

fixlist.txt

Thanks

 

[jmwang037]

Hi Advanced Setup,

A quick question before I run the fix - could I please check if I need to set up some form of back-up before I run the fix - ie, is there any risk of me losing anything else other than those cached you mentioned?

[AdvancedSetup]

The fix will enable your System Protection and attempt to create a new System Restore point. The first time you run FRST it also backs up the Registry HIVES so there are a couple ways to recover back if needed.

In general I would not expect anything bad to happen. We run these clean up scripts dozens of times a week for many users. It will only partially clean up your browsers, not all of the junk. We can look at that further after the first round of cleaning.

If you do have full imaging software like Macrium Reflect or True Image then you can certainly make a full backup if you like before you proceed.

 

Edited May 22, 2021 by AdvancedSetup
updated information

[jmwang037]

Dear lord, Advanced Setup, I am sorry but I entirely forgot I had downloaded Malwarebytes to run a scan a few days ago in a bid to salvage the situation, and I am currently running the Premium trial and the program was not disabled. Would I have to run the scan again?

Also, although I disabled Norton's functions, this appeared a few times during the fix - 

 

Nevertheless, I have attached the fixlogs here and hope they are of use. Do let me know if I have to run a scan again with MAlwarebytes and Norton disabled.

Thank you!

 

Fixlog.txt

[jmwang037]

Would also like to add that I tried the google search for "kpop music downloads" and the attack happened again. I also googled and found out how to disable data protector in Norton (wasn't aware of this function before) so do let me know if a re-scan is required. Thank you!

[AdvancedSetup]

Please disable Norton again. Then download the fix file and run it again

Thanks

 

[jmwang037]

Hi, noted, will disable Norton & Malwarebytes and run scan again. Should I delete the previous Fixlog file?

Apologies for the trouble and appreciate your patience!

[AdvancedSetup]

Yes, you can delete the previous Fixlog file - it will normally update, overwrite but you can remove it.

I have to run for a bit so I may or may not be back online for a while

After running the fix, then go here to the following topic and clean up Google Chrome

https://forums.malwarebytes.com/topic/258938-resetting-google-chrome-to-clear-unexpected-issues/

I'll check back on you as soon as possible

Thanks

 

[jmwang037]

Hi AdvancedSetup,

As instructed, ran the scan again and this time no pop-ups from Norton! Have attached the log for your review - I see some "Access denied" but I've disabled Norton already so hopefully that is fine...?

Have also run the Chrome cleanup, on both my laptop and my mobile. Ran Malwarebytes and scan returned nothing again.

However, tried the search again after the above steps and attack still happened.

Would appreciate any further advice, thanks! It's 3am on my side so I gotta disappear for some hours to get some sleep, have had some sleepless nights over this.

Thanks in advance for the assistance, AdvancedSetup! Really do appreciate it since I'm such a tech noob and get so much anxiety over these issues.

Fixlog.txt MWB2.txt

[AdvancedSetup]

You may be interested in using our new Malwarebytes Browser Guard to help protect your browser

Please install uBlock Origin for your browsers to better protect your system.

FireFox, Chrome, Opera , Safari, Microsoft Edge

 

Let me have you run a 3rd party antivirus scanner. Make sure you exit out of Malwarebytes and disable Norton first though so that it doesn't stop this scanner.

 

Let me have you run a different scanner to double-check. I don't expect it to find anything, but no harm in checking.

I would suggest a free scan with the ESET Online Scanner

Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

• It will start a download of "esetonlinescanner.exe"
• Save the file to your system, such as the Downloads folder, or else to the Desktop.
• Go to the saved file, and double click it to get it started. 
• When presented with the initial ESET options, click on "Computer Scan".
• Next, when prompted by Windows, allow it to start by clicking Yes 
• When prompted for scan type, Click on Full scan 
• Look at & tick  ( select )   the radio selection "Enable ESET to detect and quarantine potentially unwanted applications"   and click on the Start scan button.
• Have patience.  The entire process may take an hour or more. There is an initial update download.
• There is a progress window display.
• You should ignore all prompts to get the ESET antivirus software program.   ( e.g. their standard program).   You do not need to buy or get or install anything else.
• When the scan is completed, if something was found, it will show a screen with the number of detected items.  If so, click the button marked “View detected results”.
• Click The blue “Save scan log” to save the log.
• If something was removed and you know it is a false finding, you may click on the blue ”Restore cleaned files”  ( in blue, at the bottom).
• Press Continue when all done.  You should click to off the offer for “periodic scanning”.

 

Note: If you do need to do a File Restore from ESET please follow the directions below

[KB2915] Restore files quarantined by the ESET Online Scanner version 3

https://support.eset.com/en/kb2915-restore-files-quarantined-by-the-eset-online-scanner

 

[jmwang037]

Hi AdvancedSetup,

Have added the Malwarebytes Browser Guard, and also ran the Eset scanner. Came back with 1 detection that I know is safe - logs are attached.

Appreciate any other advice as after doing the above the attack still happens.. I'm starting to feel a bit hopeless about the situation. I don't understand why the attack keeps happening even though I've left the site, and only happens when I search "kpop music downloads".. Feels like a keylogger to me that triggers the attack whenever I search the keywords.

Looking forward to further assistance, thanks for your time!

Eset Scanned logs.txt

[AdvancedSetup]

You might want to do some research about iObit. It's a Chinese company with quite a checkered past.

Try using Firefox and see if you get the same issue or not and let me know.

 

[jmwang037]

I have deleted iObit, so it shouldn't be an issue anymore.

Downloaded Firefox, and this attack does not seem to happen in Firefox. Tried it with Chrome, still there - new realisation, when I search "kpop music fownload", making a spelling mistake on purpose, it still returns the web attack, so I'm thinking it might be the search results since they are similar/the same.

I understand that using Firefox might circumvent the issue, but due to my schoolwork and my school's requirements on our work, Chrome still has to be my primary browser. Is there a way that I could still possibly get rid of this? Thank you!

[AdvancedSetup]

Did you try ALL the options, including the bottom one for cleaning Google Chrome? (so glad I don't work or go to any school that requires data mining)

 

 

Force Reset Google Chrome
Reset Chrome back to defaults to completely clear out issues with Chrome.

• Open Chrome and at the top right, click  More tools  Extensions
• Write down the list of Extensions installed.
• Next, go to >> Google Sync << and sign in to your account. Make sure you know your password as this will clear it from the browser.
• Scroll down until you see the   "reset sync" button to clear your data from the server and remove your passphrase.
• Now, close all Chrome windows. Chrome cannot be running for the next step. If needed, print this information or use another browser to read the information.
• Press the Windows key + R at the same time, to bring up the Run dialog box.

• Type in (or copy/paste) the following and press Enter:     %localappdata%\Google\Chrome\User Data\Default\

1. Press Ctrl + A to select all the files and folders.
2. Hold down Ctrl + A and click once on the files "Bookmarks" and "Bookmarks.bak". This will unselect them.
3. With all the files selected (except for your Bookmarks), press the Delete key and click Yes to delete the files and folders.
4. Example of all files and folders selected, except Bookmarks
5. WARNING: If the folders do not look similar do not continue deleting. You may not be in the correct folder.

 

Restart your computer now and make sure there are no longer any redirects or other browser issues 

 

 

 

 

[AdvancedSetup]

I assume this Alert is coming from Norton?

You might try clearing the history, cache, quarantine from Norton. Reboot and see if the same issue remains

 

[jmwang037]

Hi AdvancedSetup,

Apologies for the trouble - any idea why this is happening? I copied this direct and pasted it in run - %localappdata%\Google\Chrome\User Data\Default\

[jmwang037]

[AdvancedSetup]

Place it in quotes

"%localappdata%\Google\Chrome\User Data\Default\"

 

[AdvancedSetup]

You can browse to it from Explorer as well if needed.

C:\Users\NTU Student\AppData\Local\Google\Chrome\User Data\Default

 

[jmwang037]

Oh dear, received these - 

 

I remember actually trying this out two days ago and I actually got to a page though, I'm not sure what happened.

Any idea please?

[AdvancedSetup]

Open My computer

Open the C: drive

Browse to:  C:\Users

From there you should see your profile NTU Student

Inside that folder you should see AppData 

then inside that folder you should see Local

then inside that folder you should see Google

then Chrome

then User Data

then Default

 

 

chrome://version/

 

[AdvancedSetup]

https://chromium.googlesource.com/chromium/src/+/HEAD/docs/user_data_dir.md

https://www.howtogeek.com/255653/how-to-find-your-chrome-profile-folder-on-windows-mac-and-linux/

 

[jmwang037]

Hi AdvancedSetup,

Seems like there is no Default folder in here?